diff --git a/cme/cmedb.py b/cme/cmedb.py index 4c2e84b1..3b152302 100644 --- a/cme/cmedb.py +++ b/cme/cmedb.py @@ -11,7 +11,9 @@ import sqlite3 import sys import os import argparse +from time import sleep from ConfigParser import ConfigParser +from cme.msfrpc import Msfrpc from cme.database import CMEDatabase from cme.helpers import validate_ntlm @@ -127,10 +129,49 @@ class CMEDatabaseNavigator(cmd.Cmd): except ConnectionError as e: print "[-] Unable to connect to Empire's RESTful API server: {}".format(e) + elif line == 'metasploit': + msf = Msfrpc({'host': self.config.get('Metasploit', 'rpc_host'), + 'port': self.config.get('Metasploit', 'rpc_port')}) + + try: + msf.login('msf', self.config.get('Metasploit', 'password')) + except MsfAuthError: + print "[-] Error authenticating to Metasploit's MSGRPC server!" + return + + console_id = str(msf.call('console.create')['id']) + + msf.call('console.write', [console_id, 'creds\n']) + + sleep(2) + + creds = msf.call('console.read', [console_id]) + + for entry in creds['data'].split('\n'): + cred = entry.split() + try: + host = cred[0] + port = cred[2] + proto = cred[3] + username = cred[4] + password = cred[5] + cred_type = cred[6] + + if port == '445/tcp' and proto == '(smb)': + if cred_type == 'Password': + self.db.add_credential('plaintext', '', username, password) + + except IndexError: + continue + + msf.call('console.destroy', [console_id]) + + print "[+] Metasploit credential import successful" + def complete_import(self, text, line, begidx, endidx): "Tab-complete 'import' commands." - commands = ["empire"] + commands = ["empire", "metasploit"] mline = line.partition(' ')[2] offs = len(mline) - len(text) diff --git a/cme/msfrpc.py b/cme/msfrpc.py new file mode 100644 index 00000000..409d3e60 --- /dev/null +++ b/cme/msfrpc.py @@ -0,0 +1,83 @@ +#! /usr/bin/env python2.7 + +# MSF-RPC - A Python library to facilitate MSG-RPC communication with Metasploit + +# Copyright (c) 2014-2016 Ryan Linn - RLinn@trustwave.com, Marcello Salvati - byt3bl33d3r@gmail.com +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation; either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 +# USA +# + +import msgpack +import logging +import requests + +class Msfrpc: + + class MsfError(Exception): + def __init__(self,msg): + self.msg = msg + def __str__(self): + return repr(self.msg) + + class MsfAuthError(MsfError): + def __init__(self,msg): + self.msg = msg + + def __init__(self,opts=[]): + self.host = opts.get('host') or "127.0.0.1" + self.port = opts.get('port') or "55552" + self.uri = opts.get('uri') or "/api/" + self.ssl = opts.get('ssl') or False + self.token = None + self.headers = {"Content-type" : "binary/message-pack"} + + def encode(self, data): + return msgpack.packb(data) + + def decode(self, data): + return msgpack.unpackb(data) + + def call(self, method, opts=[]): + if method != 'auth.login': + if self.token == None: + raise self.MsfAuthError("MsfRPC: Not Authenticated") + + if method != "auth.login": + opts.insert(0, self.token) + + if self.ssl == True: + url = "https://%s:%s%s" % (self.host, self.port, self.uri) + else: + url = "http://%s:%s%s" % (self.host, self.port, self.uri) + + + opts.insert(0, method) + payload = self.encode(opts) + + r = requests.post(url, data=payload, headers=self.headers) + + opts[:] = [] #Clear opts list + + return self.decode(r.content) + + def login(self, user, password): + auth = self.call("auth.login", [user, password]) + try: + if auth['result'] == 'success': + self.token = auth['token'] + return True + except: + raise self.MsfAuthError("MsfRPC: Authentication failed") \ No newline at end of file diff --git a/requirements.txt b/requirements.txt index d3fcee95..55739b6c 100644 --- a/requirements.txt +++ b/requirements.txt @@ -5,4 +5,5 @@ pycrypto pyasn1 termcolor requests -pyOpenSSL \ No newline at end of file +pyOpenSSL +msgpack-python \ No newline at end of file